@toa.io/extensions.exposition 1.0.0-alpha.23 → 1.0.0-alpha.231

package/features/flow.feature

@@ -0,0 +1,148 @@
+Feature: Request flow
+
+  Scenario: Fetching URL
+    Given the `octets.tester` is running
+    And the annotation:
+      """yaml
+      /:
+        octets:context: octets
+        /:type:
+          GET:
+            anonymous: true
+            io:output: true
+            flow:fetch: octets.tester.redirect
+      """
+    When the following request is received:
+      """
+      GET /rfc HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: text/plain
+
+      Faster Than Light Speed Protocol (FLIP)
+      """
+    When the following request is received:
+      """
+      GET /img HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: image/svg+xml
+      """
+    When the following request is received:
+      """
+      GET /err HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Composing a stream
+    Given the `sequences` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          flow:compose:
+            a: $[0]
+            b: $[1]
+            c: $[2]
+            sum: $[0] + $[1] + $[2]
+            str: \hello
+            num: 1
+            arr:
+              - $[0]
+              - $[1]
+              - $[2]
+              - $[0] + $[1] + $[2]
+            copy: $
+          POST: numbers
+      """
+    When the following request is received:
+      """
+      POST /sequences/ HTTP/1.1
+      host: nex.toa.io
+      content-type: text/plain
+      accept: application/yaml
+
+      3
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      a: 0
+      b: 1
+      c: 2
+      sum: 3
+      str: hello
+      num: 1
+      arr:
+        - 0
+        - 1
+        - 2
+        - 3
+      copy:
+        - 0
+        - 1
+        - 2
+      """
+
+  Scenario: Composing with multiple possible shapes
+    Given the `sequences` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          flow:compose:
+            - a: $[0].b.c
+            - b: $[0]
+          POST: numbers
+      """
+    When the following request is received:
+      """
+      POST /sequences/ HTTP/1.1
+      host: nex.toa.io
+      content-type: text/plain
+      accept: application/yaml
+
+      3
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      b: 0
+      """
+
+  Scenario: Composing with text value
+    Given the `sequences` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          flow:compose: $[1]
+          POST: numbers
+      """
+    When the following request is received:
+      """
+      POST /sequences/ HTTP/1.1
+      host: nex.toa.io
+      content-type: text/plain
+      accept: application/yaml
+
+      3
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      1
+      """

package/features/identity.basic.feature

@@ -39,7 +39,7 @@ Feature: Basic authentication
       exposition:
         /:
           io:output: true
-          anonymous: true     # checking compatibility with anonymous access
+          anonymous: true       # checking compatibility with anonymous access
           POST:
             incept: id
             endpoint: transit
@@ -87,6 +87,7 @@ Feature: Basic authentication
       """
       200 OK
       """
+
     # username is taken
     When the following request is received:
       """
@@ -102,6 +103,7 @@ Feature: Basic authentication
       """
       409 Conflict
       """
+
     # credentials already exists
     When the following request is received:
       """
@@ -205,7 +207,7 @@ Feature: Basic authentication
       422 Unprocessable Entity
 
       code: <code>
-      message: <problem> is not meeting the requirements.
+      message: <problem> is not meeting the requirements
       """
     Examples:
       | username                                                                                                                          | password    | problem  | code             |
@@ -316,12 +318,11 @@ Feature: Basic authentication
       422 Unprocessable Entity
 
       code: PRINCIPAL_LOCKED
-      message: Principal username cannot be changed.
+      message: Principal username cannot be changed
       """
 
   Scenario: Creating an Identity using inception with existing credentials
-    Given the `identity.basic` database is empty
-    And the `users` is running with the following manifest:
+    Given the `users` is running with the following manifest:
       """yaml
       exposition:
         /:
@@ -329,6 +330,7 @@ Feature: Basic authentication
           anonymous: true
           POST:
             incept: id
+            query: false
             endpoint: transit
       """
     When the following request is received:
@@ -352,7 +354,7 @@ Feature: Basic authentication
       POST /users/ HTTP/1.1
       host: nex.toa.io
       authorization: Basic dXNlcjpwYXNzMTIzNA==
-      content-type: text/plain
+      content-type: application/yaml
 
       name: Mary Louis
       """
@@ -360,3 +362,115 @@ Feature: Basic authentication
       """
       403 Forbidden
       """
+
+  Scenario: Incorrect credentials format
+    Given the `identity.basic` database is empty
+    And the `users` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          anonymous: true
+          POST:
+            incept: id
+            endpoint: transit
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic not-base64
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      POST /users/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic not-base64
+      accept: application/yaml
+      content-type: application/yaml
+
+      name: Bill Smith
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+
+      code: INVALID_CREDENTIALS
+      """
+
+  Scenario: Check if username is available
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     | _version |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O | 1        |
+    When the following request is received:
+      """
+      GET /identity/basic/usernames/ZGV2ZWxvcGVy/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      204 No Content
+      """
+    When the following request is received:
+      """
+      GET /identity/basic/username/bWFuYWdlcg/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Adding new basic credentials
+    Given transient identity
+    When the following request is received:
+      """
+      POST /identity/basic/${{ identity.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ identity.token }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      username: developer
+      password: secret#1234
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldCMxMjM0 
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ id }}
+      """
+
+    # credentials already exist
+    When the following request is received:
+      """
+      POST /identity/basic/${{ identity.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ identity.token }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      username: painter
+      password: secret#4321
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+
+      code: EXISTS
+      """

package/features/identity.feature

@@ -59,22 +59,29 @@ Feature: Identity resource
         - system:identity
       """
 
-  Scenario: Requesting Identity with non-existent credentials
-    Given the `identity.basic` database is empty
+  Scenario: Getting transient Identity
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
       host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNzMTIzNA==
+      accept: application/yaml
       """
     Then the following reply is sent:
       """
-      401 Unauthorized
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      roles: []
       """
+
+  Scenario: Requesting Identity with non-existent credentials
+    Given the `identity.basic` database is empty
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
       host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNzMTIzNA==
       """
     Then the following reply is sent:
       """

package/features/identity.federation.feature

@@ -3,12 +3,11 @@ Feature: Identity Federation
 
   Background:
     Given the `identity.federation` database is empty
-    Given local IDP is running
+    And local IDP is running
 
-  Scenario: Getting identity for a new user
+  Scenario: Asymmetric tokens
     Given the `identity.federation` configuration:
       """yaml
-      explicit_identity_creation: false
       trust:
         - iss: http://localhost:44444
       """
@@ -19,7 +18,6 @@ Feature: Identity Federation
       host: nex.toa.io
       authorization: Bearer ${{ User.id_token }}
       accept: application/yaml
-      content-type: application/yaml
       """
     Then the following reply is sent:
       """
@@ -29,7 +27,6 @@ Feature: Identity Federation
       id: ${{ User.id }}
       roles: []
       """
-    # validate TOKEN
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -58,41 +55,12 @@ Feature: Identity Federation
       id: ${{ User.id }}
       """
 
-  Scenario: Getting identity for a user with symmetric tokens
-    Given the `identity.federation` configuration:
-      """yaml
-      explicit_identity_creation: false
-      trust:
-        - iss: http://localhost:44444
-          secrets:
-            HS384:
-              k1: the-secret
-      """
-    And the IDP HS384 token for GoodUser is issued with following secret:
-      """
-      the-secret
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ GoodUser.id_token }}
-      accept: application/yaml
-      content-type: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ GoodUser.token }}
-
-      id: ${{ GoodUser.id }}
-      """
-
-  Scenario: Creating an Identity using inception with existing credentials
+  Scenario: Creating an Identity using inception
     Given the `identity.federation` configuration:
       """yaml
       trust:
         - iss: http://localhost:44444
+      assert: false
       """
     Given the `users` is running with the following manifest:
       """yaml
@@ -100,8 +68,8 @@ Feature: Identity Federation
         /:
           anonymous: true
           POST:
-            io:output: true
-            incept: id
+            io:output: [id]
+            auth:incept: id
             endpoint: create
       """
     And the IDP token for Bill is issued
@@ -146,6 +114,7 @@ Feature: Identity Federation
     Then the following reply is sent:
       """
       200 OK
+
       id: ${{ Bill.id }}
       """
     And the following request is received:
@@ -154,7 +123,7 @@ Feature: Identity Federation
       POST /users/ HTTP/1.1
       host: nex.toa.io
       authorization: Bearer ${{ Bill.id_token }}
-      content-type: text/plain
+      content-type: application/yaml
 
       name: Mary Louis
       """
@@ -166,14 +135,15 @@ Feature: Identity Federation
   Scenario: Granting a `system` role to a Principal
     Given the `identity.federation` configuration:
       """yaml
-      explicit_identity_creation: false
       trust:
         - iss: http://localhost:44444
       principal:
         iss: http://localhost:44444
-        sub: root-mock-id
+        sub: root
       """
     And the IDP token for root is issued
+
+    # create an identity
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -182,7 +152,6 @@ Feature: Identity Federation
       accept: application/yaml
       content-type: application/yaml
       """
-    # create an identity
     Then the following reply is sent:
       """
       200 OK
@@ -190,6 +159,9 @@ Feature: Identity Federation
 
       id: ${{ root.id }}
       """
+
+    Then after 0.2 seconds
+
     # check the role
     When the following request is received:
       """
@@ -206,3 +178,111 @@ Feature: Identity Federation
       roles:
         - system
       """
+
+  Scenario: Adding federation to an existing identity
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the `identity.basic` database is empty
+
+    # create an identity
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: nex.toa.io
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set Bob.username }}
+      password: #{{ password 8 | set Bob.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Bob.id }}
+      """
+
+    When the IDP token for Bob is issued
+
+    # add federation
+    When the following request is received:
+      """
+      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      content-type: application/yaml
+      accept: application/yaml
+
+      credentials: ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    And the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ Bob.id }}
+      """
+
+  Scenario: Authorization code flow with secret
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+          aud: nex
+          secret: secret
+      """
+    And auth code for Alice is issued for https://web.toa.io/callback/
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      authorization: Code ${{ Alice.code_credentials }}
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ Alice.token }}
+
+      id: ${{ Alice.id }}
+      """
+
+  Scenario: Authorization code flow with signature
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+          aud: nex
+          signature:
+            iss: io.toa.nex.id
+            kid: key-id
+            key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZzl4OURhdHdIMEdaSFNDbzkKVE1IVFZYeWVZMFlROHFiNzNqSFYydjRNc3llaFJBTkNBQVF3YVlsbmEyaFNWM0cvUklsTkxWNDFsZzhQbTRLZgpIZkN1S0tpdzNCSUpUblNBckFNSkxTeTF2WXdTSU1IejcyMG1rbVdUcld1UWtranZrRHBaeGZSdgotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
+      """
+    And auth code for Bob is issued for https://web.toa.io/callback/
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      authorization: Code ${{ Bob.code_credentials }}
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ Bob.token }}
+
+      id: ${{ Bob.id }}
+      """

package/features/identity.otp.feature

@@ -0,0 +1,101 @@
+Feature: OTP authentication
+
+  OTP credentials format is base64(username:password)
+
+  Background:
+    Given the `identity.otp` configuration:
+      """yaml
+      lifetime: 1
+      """
+    And the Gateway is running
+
+  Scenario: Authenticate using OTP
+    Given OTP for `alice` in `nex` authority is issued
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      """
+
+    # valid only once
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # same username is resolved to the same identity
+    Given OTP for `alice` in `nex` authority is issued
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ id }}
+      """
+
+    # expiration
+    Given OTP for `alice` in `nex` authority is issued
+    And after 1 second
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Generate own OTP
+    Given transient identity bob
+    When the following request is received:
+      """
+      POST /identity/otp/${{ bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ bob.token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      code: '${{ bob.code }}'
+      """
+
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP #{{ otp bob }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ bob.id }}
+      """